subtle crypto deriveBits using pbkdf2 throws exception if dklen >2048 bits
Categories
(Core :: DOM: Web Crypto, defect, P5)
Tracking
()
People
(Reporter: alex, Unassigned)
Details
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36
Steps to reproduce:
Currently using Firefox Quantum 60.0.2 (64-bit).
```bash
$ firefox --version
Mozilla Firefox 60.0.2
$ uname -a
Linux Alexanders-Dell-XPS13 4.16.0-2-amd64 #1 SMP Debian 4.16.12-1 (2018-05-27) x86_64 GNU/Linux
```
Trying to generate a buffer from a user inputted password. Setting the bits length to 2056 throws an exception. 2048 bits seems okay.
```js
var pw = window.crypto.getRandomValues(new Uint8Array(16));
window.crypto.subtle.importKey("raw", pw, "PBKDF2", false, ["deriveBits"]).then(key => {
console.log(key);
var st = window.crypto.getRandomValues(new Uint8Array(16));
// const keySizeBits = 2048; // this is okay
const keySizeBits = 2056; // this throws exception
return window.crypto.subtle.deriveBits({ name: "PBKDF2", salt: st, iterations: 10000, hash: "SHA-256" }, key, keySizeBits);
}).then(bits => {
console.log(bits);
}).catch(err => {
console.error(err);
});
```
Actual results:
Got the following exception: "OperationError: The operation failed for an operation-specific reason"
DOMException {
code: 0,
columnNumber: 0,
data: null,
filename: "",
lineNumber: 0,
message: "The operation failed for an operation-specific reason",
name: "OperationError",
result: 2152923168,
stack: ""
}
Expected results:
Expected console log to log an array buffer of byte length 257.
Ideally I would like to specify derived bits length of any size. My original use case is deriving bits of length 256*3*8 (6144).
|
||
Comment 1•6 years ago
|
||
I tested this on Windows 10 with the latest nightly and it is reproducible. The error shows when the script in comment 0 is run in the console. The error is "DOMException: "The operation failed for an operation-specific reason" Test env't ---------- Version 62.0a1 Build ID 20180622100109 Update Channel nightly User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
|
||
Updated•6 years ago
|
|
Assignee | |
Updated•5 years ago
|
|
||
Comment 2•4 years ago
|
||
Looks like the limitation is here:
Is there any reason this needs to have a maximum?
|
||
Comment 3•3 years ago
|
||
Any updates on this?
|
||
Updated•3 years ago
|
|
|
||
Updated•3 years ago
|
|
||
Comment 4•2 years ago
|
||
The maximum output length for PBKDF2 is implementation defined (https://datatracker.ietf.org/doc/html/rfc2898#appendix-A.2), and NSS happens to have a 2048 bit maximum. If you need a longer bit string you should use the output to seed a bit generator.
As an NSS bug this is a WONTFIX.
|
||
Comment 5•2 years ago
|
||
(New) Web Crypto spec editor here. I'm not sure your reading of the spec is correct - the Web Crypto spec refers to RFC8018 for PBKDF2, not RFC2898. Section 5.2 of RFC8018 says that:
The length of the derived key is
essentially unbounded. (However, the maximum effective search space
for the derived key may be limited by the structure of the underlying
pseudorandom function. See Appendix B.1 for further discussion.)
(...)
Steps:
1. If dkLen > (2^32 - 1) * hLen, output "derived key too long"
and stop.
RFC2898 defines an OID for PBKDF2, and can of course impose or allow additional restrictions on the output length, and the Web Crypto API could do so as well, but today it doesn't. If Mozilla's position is that it should, could you open a spec issue here to discuss this, please?
|
|
||
Comment 6•2 years ago
|
||
This is a wontfix for NSS. But the desired functionality can be implemented at a higher level. Re-opening for further discussion.
|
|
||
Comment 7•2 years ago
|
||
How the code from Alex can be implemented in firefox?
|
|
||
Comment 8•2 months ago
|
||
Two years after initially addressing this issue, it remains unresolved and reproducible. In the interim, I have explored alternatives such as nodeForge and CryptoJS; however, these libraries significantly underperform compared to the native deriveBits API in terms of speed. Is there a viable workaround to this problem, or is it still necessary to rely on non-native APIs within Firefox for this functionality?
Description
•